Node.js 20.x Bypass Perm. Model via process.binding() Path Traversal
CVE-2023-32558 Published on September 12, 2023

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

NVD

Vulnerability Analysis

Exploitation:

NONE

Automatable:

YES

Technical Impact:

PARTIAL

Products Associated with CVE-2023-32558

stack.watch emails you whenever new vulnerabilities are published in nodejs node.js or nodejs. Just hit a watch button to start following.

nodejs node.js

  Watch

nodejs

  Watch

Affected Versions

• Version 4.0 and below 4.* is affected.
• Version 5.0 and below 5.* is affected.
• Version 6.0 and below 6.* is affected.
• Version 7.0 and below 7.* is affected.
• Version 8.0 and below 8.* is affected.
• Version 9.0 and below 9.* is affected.
• Version 10.0 and below 10.* is affected.
• Version 11.0 and below 11.* is affected.
• Version 12.0 and below 12.* is affected.
• Version 13.0 and below 13.* is affected.
• Version 14.0 and below 14.* is affected.
• Version 15.0 and below 15.* is affected.
• Version 17.0 and below 17.* is affected.
• Version 19.0 and below 19.* is affected.
• Version 20.0 and below 20.5.1 is affected.

Exploit Probability